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DECLARATION OF ELIZABETH T. HAN 
PURSUANT TO 28 U.S.C. § 1746 


I, Elizabeth T. Han, hereby state that I have personal knowledge of the facts set forth below. If 


called as a witness, I could and would testify competently as follows: 


1. 


I am a citizen of the United States and over the age of eighteen (18) years old. lam 
employed as an investigator with the Federal Trade Commission (“FTC’’) in the Division 
of Financial Practices. My office address is 600 Pennsylvania Avenue, N.W., CC 10232, 
Washington, D.C., 20580. 

I began working at the FTC in June 2013. My responsibilities include investigating 
suspected violations of consumer protection laws. In the normal course of carrying out 
my investigative responsibilities, I regularly use Internet search engines, electronic 
databases, spreadsheet software, and a variety of other software-based investigative and 
organizational tools. I regularly review a variety of records, including bank, domain, and 
telecom records, engaging in analysis for indicators of fraudulent activity. I am also a 
Certified Fraud Examiner (“CFE”), a certification first obtained in February 2012. To 
become a CFE, I had to pass an exam which tested four subject areas: (1) fraud 
prevention and deterrence; (2) fraudulent financial transactions; (3) fraud investigations; 
and (4) legal elements of fraud. 

Prior to working at the FTC, I was an investigator with the U.S. Department of 
Commerce — Office of Inspector General (OIG) for almost three years. My 
responsibilities for OIG included investigating contract and procurement fraud, grant 
fraud, serious employee misconduct, and gross mismanagement. In the normal course of 


carrying out my investigative responsibilities, I regularly used Internet search engines, 
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electronic databases, and spreadsheet software. I also regularly reviewed financial 
documents, including contract and grant documents, engaging in analysis for indicators 
of fraudulent activity. 

4, At the FTC, I was assigned to the investigation of the defendants named in the complaint 
that the FTC has filed herewith. The defendants include one company: BF Labs, Inc. 
d/b/a Butterfly Labs (“Butterfly Labs”), and three individuals: Darla Drake a/k/a Jody 
Drake (“Drake”), Nasser Ghoseiri (““Ghoseiri’’), and Sonny Vleisides (“Vleisides”’) 
(collectively referred to as “Defendants”). Drake, Ghoseiri, and Vleisides, will be 
referred to separately as “Individual Defendants.” 

3: During the course of this investigation, I found articles reporting that Butterfly Labs was 
the first company to advertise a 65nm bitcoin mining machine. True and correct copies of 
articles containing such statements are attached here as Attachments (“‘Att.”) A - B. 

6. In December 2013, Butterfly Labs maintained a projected shipping date of 
“November/December” for the first round of customers who had paid up front for the 
Monarch. A true and correct copy the order page as captured by the Internet Archive’ on 
December 3, 2013, is attached here as Att. C. 

7: During the course of this investigation, the FTC obtained records from BMO Harris Bank 

' The Internet Archive is a non-profit organization founded in 1996 that administers an archive of over 408 billion 

websites, with the goal of preserving permanent access for researchers, historians, scholars, and the general public. 

The pages are captured on a sporadic schedule and not every version of Butterfly Labs’ product page was captured. 


As aresult, some of the reported information we have regarding Butterfly Labs’ product offerings, such as pricing, 


cannot be supported by a corresponding website capture. 
The Internet Archive preserved the Butterfly Labs website as it existed on particular dates in time. In the course of 


this investigation, we utilized the Internet Archive by downloading copies of the Butterfly Labs home, product, 


ordering, and forum pages as they were preserved on specific dates, and stored them as PDFs. 
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on March 21, 2014, pursuant to a CID issued by the FTC. The documents produced 


included bank statements, checks, deposits, wire transfers, and account signature cards, 


from September 2012 to June 2014. A true and correct copy of the entire production is 


available upon request. 


8. I reviewed the records from BMO Harris, and observed that members of the 


management, including Mr. Ghoseiri, Innovation Officer, Mr. Vleisides, Innovation 


Officer, Jeff Ownby, Vice-President of Marketing and Ecommerce, and Josh Zerlan, VP 


of Product Development, received loans via wire transfer from Butterfly Labs’ corporate 


operating account, ending in xxx5901. The transfers were labeled with notes such as 


“loan against future earnings.” Below is a table identifying the loans made via wire 


















































transaction. 

Recipient Amount Date ee Note 
Nasser Ghoseiri $16,000 June 17, 2013 130617503805 | Loan Against Future Earnings 
Nasser Ghoseiri $16,000 June 17, 2013 130617503944 | Loan Against Future Earnings 
Jeffrey Ownby $50,000 July 19, 2013 130719013661 | Loan against Dividends 
Nasser Ghoseiri $12,000 September 9, 2013 130909504144 | Loan against Future Earnings 
Nasser Ghoseiri $12,000 September 9, 2013 130909504175 | Loan against Future Earnings 
Sonny Vleisides $20,160 September 18, 2013 | 130918503539 | Loan against future earnings 
Sonny Vleisides $20,160 September 26, 2013 | 130926502060 | Loan against Future Earnings 
Jeffrey Ownby $50,000 July 19, 2013 130719013661 | Loan against Dividends 
Jeffrey Ownby $50,000 July 23, 2013 130723005004 | Advance against dividends 
Jeffrey Ownby _| $10,000 October 3, 2013 131003008585 ee : es 
Jeffrey Ownby _| $5,000 March 14, 2014 1403140g05ag)) omnes Nowe tonJeliney 














Ownby, against future earnings 
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10. 


ele 


True and correct excerpts of the bank records reflecting such wire transactions are 
attached here as Att. D. 

During the course of this investigation, I observed many consumers posting on internet 
forums about their difficulty in obtaining a refund from Butterfly Labs after waiting 
lengthy periods for their orders. The consumers who successfully obtained a refund 
utilized internet forums to post their strategies in an effort to aid other consumers. 
Strategies included contacting PayPal’s fraud department and engaging in the credit card 
chargeback process. True and correct copies of these internet postings are attached here 
as Att. E-F. 

During the course of this investigation, I observed many consumers posting on internet 
forums that they believed Butterfly Labs was retaining the mining machines for their own 
use, and only shipping the mining machines after they had exhausted the machine’s 
capabilities. Butterfly Labs repeatedly stated they were not mining with equipment built 
for consumers. True and correct copies of these statements are attached here as Att. G -— 
H. 

On September 22, 2014, I ran a search of complaints in the FTC’s complaint database, 
searching for all complaints against Butterfly Labs from March 1, 2014 to September 22, 
2014. I found 40 complaints, which I reviewed. I observed that many consumers were 
continuing to experience difficulty getting a refund, with a complaint filed that same day 
by a consumer who stated they had just made a second request for their refund for an 
order they placed on January 5, 2014. Additionally, many consumers report they do not 
want the product because of how long it has been delayed; consumers state the lengthy 


delay has rendered the product ineffective and useless. A true and correct copy of the 
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12. 


13, 


14. 


spreadsheet of complaints I downloaded from the FTC’s complaint database is attached 
here as Att. I. 

On September 19, 2014, I entered Defendants’ business premises at 10770 El Monte St., 
Suite 101, Leawood, KS 66211; 10606 Widmer Road, Lenexa, KS 66215; and 17501 
West 98" St., Lenexa, KS 66219 pursuant to a court order. Upon entering each location, 
it was evident that the defendants operated their business primarily from 10770 El Monte, 
and utilized the other two locations as storage facilities. During my inspection of the 
10770 El Monte location, I created a map of the premises layout. In addition, I took 
photos documenting each location. A true and correct copy of the map I created of 10770 
El Monte is attached here as Att. J. Photographs of each location are available upon 
request. 

During my inspection of each of the Butterfly Labs premises, computer forensic 
examiner Ryan Lex, employed by the temporary court-appointed receiver, was 
participating in a walkthrough alongside the receiver. Mr. Lex recorded his walk-through 
of all three Butterfly Labs premises, and provided those recordings to me for review. I 
was present for much of the time Mr. Lex was recording. 

During my inspection of the premises located at 10770 El Monte, I observed red foam 
pitchforks, with the words “BFL is late!” and “Y U NO SHIP!” imprinted on them, 
located at various places within the offices and work stations. There were many red foam 
pitchforks being stored in Mr. Zerlan’s office at 10770 El Monte, as well as at the storage 
facility located at 17501 West 98" St. True and correct copies of photos and/or image 
stills from Mr. Lex’s video recordings demonstrating the locations of the items are 


attached here as Atts. K —M. 
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ie During my inspection of the premises located at 10770 El Monte, I entered a trailer 
attached to the back of the building, identified as Room J on Att. A. In this trailer, there 
were racks of computing units powered on. The trailer also contained many fans, which 
were operating to keep the computing units cooled. I observed that the racks lined with 
computing units also contained small ASUS-brand computers running what appeared to 
be a bitcoin mining software. A true and correct copy of the photos of Room J are 
attached here as Atts. N — T. 

16. During my inspection of the premises located at 10770 El Monte, I entered another room 
containing racks of computing units powered on, identified as Room F on Att. A. In this 
room, the computing units were also powered on, with ventilation provided from a 
connecting room running to keep the units cooled. Again, the racks lined with computing 
units also contained small ASUS-brand computers running what appeared to be a bitcoin 
mining software. A true and correct copy of the photos of Room F are attached here as 
Atts. U - W. 

Td, During my inspection of the premises located at 10606 Widmer, John Mutrux, a Butterfly 
Labs employee, accompanied Mr. Lex and the receiver, explaining what each set of 
boxes in the facility contained. I observed many pallets of boxed parts filling both sides 
of the warehouse. Mr. Mutrux identified many of the parts in storage at 10606 Widmer as 
“obsolete” or no longer capable of being used because of design changes. Further, Mr. 
Mutrux identified a safe containing boxes of brand-new Nexus 7 tablets” that were 
purchased to operate mining software, and are currently sitting unused. True and correct 
excerpts of Mr. Lex’s video recordings of Mr. Mutrux’s identification of stored parts, 


* http://www.google.com/nexus/7/; the Nexus 7 tablet is a mobile media product manufactured by Google, and runs 
their Android operating system. 
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18. 


19. 


20. 


created when I was present, are available upon request. 

During my inspection of the premises located at 17501 98", Mr. Mutrux again 
accompanied Mr. Lex and the receiver, and explained what each set of boxes in the 
facility contained. I observed this warehouse to be approximately two times as large as 
the facility at 10606 Widmer, and had pallets of boxed parts filling both sides as well as 
down the middle of the facility. Mr. Mutrux identified many of the parts in storage at 
17501 98" as “obsolete” or no longer capable of being used because of design changes. 
Mr. Mutrux also identified boxes of completed, older generation mining machines 
manufactured by Butterfly Labs, as “obsolete.” Lastly, Mr. Mutrux identified multiple 
pallets of boxed parts as having been procured for future products Butterfly Labs 
currently has in development and hopes to put onto the market. Some of these boxed 
parts are for products Mr. Mutrux identified as “not anywhere near production.” True and 
correct excerpts of Mr. Lex’s video recordings of Mr. Mutrux’s identification of stored 
parts, created when I was present, are available upon request. 

During my inspection of the premises located at 10770 El Monte, I located the computers 
of some of Butterfly Labs’ principals, including Mr. Vleisides, and Mr. Zerlan. While on- 
site, the FTC had forensic examiners present who created either a logical copy or a 
forensic image of these identified computers. Upon my return to FTC offices in 
Washington, D.C., I reviewed the forensic images, and was able to review the contents of 
each principal’s machines, reviewing items such as internal chat logs, excel spreadsheets, 
and audio files, that the user had saved to their machine. 

In reviewing Mr. Zerlan’s machine, I reviewed an audio file entitled “2013 Refund 


Policies.wav” with a last modified date of April 17, 2014, at 4:28pm. The audio file was a 
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pe 


recording stating that because orders had begun shipping, no refunds would be processed. 
A true and correct copy of the audio recording located on Mr. Zerlan’s computer is 
available upon request. 

I also found text files on Mr. Zerlan’s computer representing internal chat logs between 
members of Butterfly Labs’ management team, including Mr. Zerlan, Mr. Vleisides, and 
Ms. Drake, the General Manager. One text file I found, entitled “communication 
group.txt” with a last modified date of September 3, 2014, contains logs of conversations 
that occurred between the principals during the period from June 10, 2013 — September 3, 
2014. The principals discussed many topics, including Butterfly Labs’ upgrade program, 
shipment delays and refund policies. True and correct excerpts of the chat logs, with 
portions highlighted, are attached here as Att. X. 

In reviewing Mr. Vleisides’ computer, I came across many spreadsheets, one of which 
was entitled “Receivables wallets — 04-18-14.csv” with a last modified date of April 18, 
2014. The spreadsheet contained a log of transactions to bitcoin wallets addresses, which 
match known Butterfly Labs bitcoin wallet addresses. Many of the transactions are 
labeled in a manner indicating they represent funds gained from mining — for example, 
“Received with ... New Eclipse burnin mining account,” “Received with... Bitcoin 
mining — Eclipse pool,” and “Received with ... Forfeiture from Janette to company of 15 
bitcoins from office mining project.” True and correct copies of the spreadsheets are 
available upon request. 

Following my inspection of the premises, I learned of at least eleven bitcoin wallets 
designated for and/or containing corporate funds from the temporary court-appointed 


receiver. Of the eleven wallets identified, wallet addresses were only known for six. The 
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receiver was going to ascertain the remaining wallet addresses, as well as the private keys 
to each of the wallets, in order to move any corporate funds to a secured bitcoin wallet 


controlled by the court, in order to prevent asset dissipation. 


Pursuant to 28 U.S.C. § 1746, I declare under penalty of perjury that the statements made in this 


declaration are true and correct. 


Executed in Washington, D.C. on September 26, 2014. 
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